Enterprise fabric configured to support cellular mobility

ABSTRACT

A mobility management entity (MME) controls an enterprise fabric. The MME receives from a mobile device via a cellular network a request to initiate an attach procedure. In response, the MME acquires from the mobile device a unique equipment identifier of the mobile device. The MME generates an enterprise identity for the mobile device based on the unique equipment identifier, and registers the enterprise identity in the enterprise fabric. The MME signals to a user plane function of the cellular network that the mobile device has been registered, to trigger the user plane function to acquire an Internet Protocol (IP) address of the mobile device based on the enterprise identity. The MME receives from the user plane function the acquired IP address. The MME sends to the mobile device, through the cellular network, an attach accept message that includes the acquired IP address for use by the mobile device.

TECHNICAL FIELD

The present disclosure relates to an enterprise fabric configured tosupport cellular mobility enterprise techniques to assist in congestioncontrol of traffic flows in a network.

BACKGROUND

Private Long-Term Evolution (cellular) systems and enterprise fabricsare presently being deployed. Enterprise fabrics provide unified policyacross wired networks and wireless networks, but not cellular networks.Some conventional cellular systems, e.g., 3rd Generation PartnershipProject (3GPP), operate with a servicing gateway (SGW) and a packet datanetwork gateway (PGW), which adds complexity to the systems, and makesit difficult to integrate the cellular systems into an enterprise fabricfor purposes of unified policy.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is an illustration of a network environment, which includes anenterprise fabric configured to support cellular mobility and enforcefabric-wide policy, according to an example embodiment.

FIG. 2 is a flowchart of a high-level method of attaching acellular-enabled mobile device to the enterprise fabric, performed by amobility management entity (MME) that controls the enterprise fabric,according to an example embodiment.

FIGS. 3A-3E collectively represent a thread diagram that expands onoperations of the method of FIG. 2, according to an embodiment.

FIG. 4 is a block diagram of a network device representative of a switchat an edge of the enterprise fabric, according to an embodiment.

FIG. 5 is a block diagram of a computer device representative of amobility management entity (MME) used to control the enterprise fabric,according to an embodiment.

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

A mobility management entity (MME) is configured to control anenterprise fabric. The MME receives from a mobile device via a cellularnetwork a request to initiate an attach procedure. In response, the MMEacquires from the mobile device a unique equipment identifier of themobile device. The MME generates an enterprise identity for the mobiledevice based on the unique equipment identifier, and registers theenterprise identity in the enterprise fabric. The MME signals to a userplane function of the cellular network that the mobile device has beenregistered in the enterprise fabric, to trigger the user plane functionto acquire an Internet Protocol (IP) address for the mobile device basedon the enterprise identity. The MME receives from the user planefunction of the cellular network a message indicating the acquired IPaddress. The MME sends to the mobile device via the cellular network anattach accept message that includes the acquired IP address for use bythe mobile device. The attach accept message indicates that the attachprocedure is complete, and that the enterprise fabric is configured tosupport a communication session with the mobile device through thecellular network.

Example Embodiments

With reference to FIG. 1, there is an illustration of an example networkenvironment 100, which includes an enterprise fabric configured tosupport cellular mobility and enforce fabric-wide policy. Networkenvironment 100 includes an enterprise network fabric 102 (referred tosimply as an “enterprise fabric”), a fabric-enabled mobility managemententity (MME) 104 to provided overall control of enterprise fabric, a mapserver 106 accessible to the MME and the enterprise fabric, a portion108 of a cellular/mobile phone network, cellular-enabled user equipment(UE) 110 (also referred to as a “mobile device” (MD)) to access theenterprise fabric via the cellular network, and an Authentication,Authorization, and Accounting (AAA) server 112 used by the MME toauthenticate/authorize mobile device access to the enterprise fabric.The terms “cellular-enabled” or “cellular-based” mean configured tooperate in accordance with presently known or hereafter developedcellular air-interface standards, such as the Long-Term Evolution (LTE)standards, and so on.

In the example of FIG. 1, portion 108 of the cellular network includes a3GPP small cell, and mobile device 110 employs known or hereafterdeveloped 3GPP protocols to communicate and connect with/attach to the3GPP small cell. Also, in the 3GPP small cell example, AAA server 112represents a home subscriber server (HSS). The HSS includes a databaseof user-related and subscriber-related information, such as subscriberprofiles, and performs subscriber authentication and authorization. TheHSS may also provide subscriber location information and InternetProtocol (IP) information.

Enterprise fabric 102 may employ Software Defined Access (SDA), providedby Cisco, for example. Thus, enterprise fabric 102 represents aprogrammable network that provides software-based policy andsegmentation from an edge of the enterprise fabric toapplications/devices external to the enterprise fabric that access theenterprise fabric. Enterprise fabric 102 may span different locations(or sites), such as a main campus, remote branches, and so on, each withmultiple devices, services, and policies. Enterprise fabric 102 providesan end-to-end architecture that ensures consistency in terms ofconnectivity, segmentation, and policy across the different locations.

Enterprise fabric 102 includes a fabric edge switch SW1 on an edge ofthe enterprise fabric to connect with small cell 108. That is, switchSW1 is an access point for small cell 108 into enterprise fabric 102.Switch SW1 operates as a point of policy enforcement in enterprisefabric 102. That is, switch SW1 enforces enterprise fabric policy ontraffic flowing through the switch, e.g., between mobile device 110 andenterprise fabric 102. FIG. 1 shows only one fabric edge switch SW1 andone small cell 108 for the sake of simplicity; however, it is understoodthat many fabric edge switches and their associated small cells may beconnected to each other in network environment 100. In addition,enterprise fabric 102 includes, or is associated with, a border edgeproxy tunnel router (PxTR) 120 that provides the enterprise fabric withaccess to external networks, which may include one or more wide areanetworks (WANs), such as the Internet (not shown in FIG. 1). Trafficflowing between enterprise fabric 102 and the external networkstraverses PxTR 120.

Structurally, enterprise fabric 102 includes an overlay network built ontop of an underlay network. The overlay network represents a virtuallayer of enterprise fabric 102, and includes a fabric control plane, afabric data plane, and a fabric policy plane. The overlay network mayemploy network tunneling technologies, such as, but not limited to, theLocator Identifier Separator Protocol (LISP) (e.g., which uses ResourceLocators (RLOCs) and endpoint identifiers (EIDs)). The underlay networkrepresents a physical layer of enterprise fabric 102, which includesphysical network devices, such as routers and switches, to supporttraffic flows defined in the overlay network.

While MAP server 106 provides a central control point for mobilityacross enterprise fabric 102, MME 104 represents an access control pointthat integrates operationally with the map server. To this end, in oneembodiment, MME 104 communicates with: (i) AAA/HSS 112 usingcellular-based protocols, i.e., over an interface that employs aprotocol defined for the cellular network; (ii) map server 106 usingSDA-based protocols, i.e., over an SDA-defined interface; and (iii)small cell 108 using both cellular-based and SDA-based protocols, i.e.,over both cellular and SDA interfaces. MME 104 communicates with mobiledevice 110 via small cell 108; for example, logically, non-accessstratum (NAS) messages are exchanged between the mobile device and theMME, but these messages are transported over the access stratum betweenthe mobile device and the small cell.

Map server (MS) 106 represents a distributed mapping database andservice that accepts registration information for user equipment (e.g.,mobile device 110), and stores mappings between namespace constructsused by the overlay of enterprise fabric 102. The mappings definetunnels for traffic flows across and in-and-out of enterprise fabric102. In the LISP example, map server 106 stores mappings between RLOCsfor switches (e.g., switch SW1) and EIDs for mobile devices (e.g.,mobile device 110) associated with the switches. Typically, the EIDincludes a media access control (MAC) address of/provided by the mobiledevice.

Enterprise fabric 102 may also connect with wireless access points(APs), which serve WiFi-enabled clients. Such WiFi interoperability isnot shown in FIG. 1 to reduce illustration complexity; however, it isunderstood that enterprise fabric 102 may support both the (cellular)small cells and WiFi clients at the same time.

According to existing 3GPP standards, conventional 3GPP networks and/ortheir supporting networks include a serving gateway (SGW) and a packetdata network gateway (PGW). The PGW is an IP point of attachment thatacts as an anchor for mobility between different systems, such as LTEand 3GPP. The PGW also provides policy enforcement. The SGW and the PGWadd substantial complexity to the 3GPP network. Accordingly, embodimentspresented herein omit the SGW and the PGW to provide a simplifiedarchitecture to support 3GPP small cell connectivity relative toconventional 3GPP networks. Most of the functions normally performed bythe SGW and the PGW are handled by MME 104, although some of thefunctions are also integrated into/across map server 106, switch SW1,and a user plane function.

In addition, conventional enterprise fabrics rely on MAC address-basedfabric constructs/mappings (e.g., switch address-endpoint addressmappings) for traffic routing. The MAC address-based constructs arebased, in part, on MAC addresses provided to the enterprise fabrics bymobile devices, e.g., WiFi-enabled devices, when the mobile devicesconnect to the enterprise fabrics. Similarly, enterprise fabric 102relies on MAC address-based constructs; however, in the example of FIG.1, mobile device 110 is cellular-based (e.g., a 3GPP terminal), and doesnot have a MAC address. Accordingly, embodiments presented hereingenerate a pseudo MAC address for mobile device 110 when the mobiledevice attaches to enterprise fabric 102 (via small cell 108), and theenterprise fabric uses the pseudo MAC address for constructs/mappingsrelated to traffic routing.

With reference to FIG. 2, there is a flowchart of an example high-levelmethod 200 of attaching a cellular-enabled mobile device (e.g., mobiledevice 110) to enterprise fabric 102, performed primarily by MME 104.Method 200 is performed without any interaction with an SGW and withoutany interaction with a PGW. Also, method 200 assumes that mobile device110, e.g., a 3GPP terminal, does not have a MAC address.

At 202, MME 104 is configured to control enterprise fabric 102. Forexample, MME 104 is configured with network address information thatenables the MME to communicate with map server 106, small cell 108, andAAA/HSS 112.

Initially, mobile device 110 sends to a cellular network an attachrequest to initiate an attach procedure, and the cellular networkforwards the attach request to MME 104. In the example, of FIG. 1,mobile device 110 sends the attach request to small cell 108 (e.g., a3GPP small cell), and the small cell forwards the attach request toenterprise fabric 102. Mobile device 110 includes in the attach requesta temporary identifier of the mobile device.

At 204, MME 104 receives the attach request originated at mobile device110. The attach request represents a request originated at mobile device110 to attach to small cell 108 and enterprise fabric 102. Uponreceiving the attach request, MME 104 initiates an attach procedure,implemented in this and next operations 206-216. MME 104 exchangesidentity request/response messages with mobile device 110 to acquirepermanent identifiers of the mobile device that will be used in place ofthe temporary identifier provided in the attach request. Specifically,MME 104 sends to mobile device 110 an identity request for the permanentidentifiers. In response to the identity request, mobile device 110sends to MME 104 (and MME 104 receives) an identity response thatincludes a permanent unique equipment identifier (UEI) of the mobiledevice that is programmed into the mobile device. In an example, theunique equipment identifier includes an International Mobile EquipmentIdentity number (IMEI). The identity response may also include aninternational mobile subscriber identity (IMSI) used to authenticatemobile device 110.

At 206, MME 104 communicates with AAA/HSS 112 to authenticate mobiledevice 110 based on the IMSI. MME 104 also authorizes mobile device 110for access to, i.e., to attach to, enterprise fabric 102.

Enterprise fabric 102 uses MAC address-based constructs for routingtraffic. Accordingly, at 208, MME 104 generates from the uniqueequipment identifier provided by mobile device 110 an enterpriseidentity for the mobile device. In an embodiment, MME 104 generates apseudo MAC address as the enterprise identity for the mobile device,based on the IMEI of mobile device 110. The term “pseudo” means that theMAC address is not an actual, predetermined MAC address of the mobiledevice, but rather an artificial MAC address that is created to satisfyoperational requirements of enterprise fabric 102.

At 210, MME 104 registers mobile device 110, i.e., the enterpriseidentity of the mobile device, in enterprise fabric 102. To do this, MME104 registers the enterprise identity, e.g., the pseudo MAC address, inmap server 106. MME 104 also registers other information in map server106, including, e.g., a resource locator (RLOC) for switch SW1 at theedge of enterprise fabric 102 and through which small cell 108 connectsto the enterprise fabric, and a security group tag (SGT) associated witha security group access control list (SGACL) used to enforce enterprisefabric policy at the switch.

At 212, MME 104 signals to a user plane function of the cellularnetwork, e.g., to a user plane function of small cell 108, that themobile device has been registered in enterprise fabric 102. This signaltriggers the user plane function of small cell 108 to acquire an IPaddress for the enterprise identity of mobile device 110. That is, theuser plane function of small cell 108 operates on behalf of mobiledevice 110 to acquire the IP address. The user plane function of smallcell 108 uses the Dynamic Host Configuration Protocol (DHCP) to acquirethe IP address for mobile device 110. For example, small cell 108 mayinvoke DHCP with switch SW1 (which serves as the enterprise fabricconnection point to small cell 108) to acquire the IP address. Mobiledevice 110 does not initiate DHCP to acquire the IP address. In anotherexample, the user plane function automatically generates the IP addressas an IPv6 address using the pseudo MAC address and a configured IPv6prefix.

At 214, the user plane function of small cell 108 sends to MME 104, andthe MME receives, a message including the IP address acquired throughDHCP.

At 216, MME 104 sends to mobile device 110 via small cell 108 an attachaccept message that includes the acquired IP address for use by themobile device. The attach accept message represents an indication thatthe attach procedure initiated at 204 has been completed successfully,i.e., that the enterprise fabric has processed the attach requestsuccessfully and is now configured to support a communication sessionwith the mobile device through small cell 108.

With reference to FIGS. 3A-3E, there is an example thread diagram 300(spanning FIGS. 3A-3E) that expands on operations 204-216 of method 200.Transactions and messages (referred to collectively as “transactions”)of thread diagram 300 are enumerated using square brackets 3[1]-3[29].The following list provides an approximate mapping between high-leveloperations 204-216 of method 200 performed primarily by MME 104 andselected ones of transactions 3[1]-3[29] that also primarily relate toMME operation:

-   -   a. Receive and process attach request 204, includes transaction        3[2], 3[2.1].    -   b. Authenticate and Authorize 206, includes transactions        3[3]-3[10].    -   c. Generate enterprise identity 208, includes transaction 3[11].    -   d. Register mobile device 210, includes transactions 3[12],        3[13].    -   e. Signal user plane function of small cell to trigger        acquisition of IP address 212, includes transactions 3[16],        3[17].    -   f. Receive acquired IP address 214, includes transaction 3[18].    -   g. Send attach accept message 216, includes transaction 3[20].

Reference is first made to FIG. 3A. At 3[1], mobile device 110 sends theabove-mentioned attach request to small cell 108. The attach requestincludes a temporary identifier of mobile device 110. At 3[2], smallcell 108 forwards the attach request, combined with a packet datanetwork (PDN) request, to MME 104 over an S1 cellular interface. Theattach request initiates an attach procedure in enterprise fabric 102(and small cell 108).

At 3[2.1], responsive to the attach request, MME 104 exchanges withmobile device 110 NAS messages over uplink and downlink NAS signalinglinks to acquire from the mobile device multiple permanent mobile deviceidentifiers, including an IMEI and an IMSI of the mobile device. The NASsignaling links use transport by the S1 AP protocol between MME 104 andsmall cell 108, and transport by Radio Resource Control (RRC) betweenthe small cell and mobile device 110. Specifically, MME 104 signals tomobile device 110 an identity request NAS message via downlink NASsignaling. Responsive to the identity request, mobile device 110 signalsto MME 104 an identity response NAS message via uplink NAS signaling.The identity request carries the IMEI and the IMSI.

At 3[3], 3[4], MME 104 interacts with AAA/HS S 112 to beginauthentication of mobile device 110, based on the user equipmentidentifier provided to the AAA/HSS at 3[3].

At 3[5], MME 104 issues to mobile device 110 an authentication requestNAS message via downlink NAS signaling. The authentication requestincludes information from AAA/HSS 112 received by MME 104 at 3[3]. At3[6], MME 104 receives from mobile device 110 an authentication responseNAS message via uplink NAS signaling.

At 3[7], MME 104 sends to mobile device 110 a security mode command NASmessage via downlink NAS signaling. At 3[8], MME 104 receives frommobile device 110 a security mode complete NAS message via uplink NASsignaling. 3[7], 3[8] establish an encrypted connection with mobiledevice 110.

At 3[9], MME 104 sends to AAA/HSS 112 an update location request. At3[10], MME 104 receives from AAA/HSS 112 an update location requestanswer. The answer indicates that mobile device 110 is authorized tojoin enterprise fabric 102.

At 3[11], responsive to the received authorization, MME 104 generates anenterprise identity (also referred to as “UE identity”) for mobiledevice 110 based on the user equipment identifier of the mobile device.In an embodiment in which the user equipment identifier includes anIMEI, MME 104 generates the enterprise identity as a pseudo MAC addressfor mobile device 110 based on the IMEI. For example, MME 104 maygenerate the pseudo MAC address as a 48-bit combination of (i) a 24-bitreserved Institute of Electrical and Electronics Engineers (IEEE)organizationally unique identifier (OUI), followed by (ii) a 24-bit hashof at least a portion of the IMEI, which represents a 24-bit extensionidentifier. The IMEI includes a type allocation code (TAC) and a serialnumber of mobile device 110. The hash may include a hash of the TAC andthe serial number. In enterprise fabric 102, the pseudo MAC addressrepresents a layer-2 (L2) virtual extensible local area network (LAN)(VxLAN) network identifier (ID) (VNID) of mobile device 110.

Reference is now made to FIG. 3B. At 3[12], MME 104 registers mobiledevice 110 in enterprise fabric 102. To do this, MME 104 stores in mapserver 106 the L2 VNID (e.g., the pseudo MAC address) as an EID ofmobile device 110. Also, MME 104 stores in map server 106, intype-length-value (TLV) form, an RLOC for switch SW1, along with asecurity group tag (SGT) and an associated IP address. At 3[13], mapserver 106 acknowledges the registration 3[12].

At 3[14], map server 106 notifies switch SW1 of the registration thatoccurred at 3[12], and provides the registration information from 3[12]to the switch. In response, switch SW1 creates an L2 entry for the L2VNID (i.e., the pseudo MAC address) of mobile device 110. This entrywill be used by switch SW1 to fetch SGACLs associated with the SGT forhandling traffic for mobile device 110. In this way, switch SW1 becomesa point of policy enforcement for the traffic in enterprise fabric 102.

Reference is now made to FIG. 3C. At 3[15], map server 106 sends toborder edge PxTR 120 an unsolicited solicited map request (SMR) messagewith respect to the L2 VNID (i.e., the pseudo MAC address), to cause theborder edge PxTR to update its EID in a local cache.

Reference is now made to FIG. 3D. At 3[16], MME 104 sends to the userplane function of small cell 108 an add-mobile message, which includesthe pseudo MAC address of mobile device 110.

At 3[17], responsive to 3[16], the user plane function of small cell 108performs DHCP with a DHCP server function accessible to switch SW1 toacquire an IP address for mobile device 110 based on the pseudo MACaddress. The user plane function of small cell 108 receives the IPaddress from switch SW1. Thus, the result of 3[16] is to trigger theDHCP process in 3[17] to acquire the IP address. The IP address will beused to route mobile device traffic across enterprise fabric 102 througha VxLAN tunnel.

At 3[18], the user plane function of small cell 108 sends to MME 104 amessage including the IP address.

At 3[19], MME 104 sends a dummy session request and a dummy sessionresponse to itself. The session request and response are normallyexchanged with the SGW, which is omitted from the present embodiments.

At 3[20], responsive to the dummy session response, MME 104 sends tosmall cell 108 an attach accept message, which includes the IP addressfor mobile device 110. The attach accept indicates the attach procedureis complete, and that enterprise fabric 102 is operational with respectto connecting to mobile device.

Reference is now made to FIG. 3E. At 3[21], small cell 108 forwards tomobile device 110 the attach accept message (as an RRC connectionreconfiguration command), including the IP address for the mobiledevice.

At 3[22], small cell 108 receives from mobile device 110 areconfiguration complete message (as an RRC connection reconfigurationcomplete command).

At 3[23], small cell 108 sends to MME 104 an initial context setupcomplete message, indicating that mobile device 110 is configured toattach to enterprise fabric 102.

At 3[24], small cell 108 receives from mobile device 110 an attachcomplete signifying that the mobile device is attached enterprise fabric102. At 3[25], small cell 108 forwards to MME 104 the attach complete.

At 3 [26], switch SW1 registers with map server 106 L2 informationindicated in FIG. 3C for the Transmission Control Protocol (TCP). At3[27], switch SW1 registers with map server 106 layer-3 (L3) informationfor virtual private network (VPN) routing and forwarding (VRF), as shownin FIG. 3C.

At 3[28], map server 106 forwards the L2 information registered at 3[26]to MME 104, which receives and stores the L2 information.

At 3[29], map server 106 sends to border edge PxTR 120 anotherunsolicited SMR message in connection with the L2 and L3 informationdescribed above.

Transactions 3[1]-3[29] of thread diagram 300 may be grouped into thefollowing high-level functional operations:

-   -   a. 3GPP UE (e.g., mobile device 110) authentication and initial        attachment, initiate attach procedure—transactions 3[1]-3[8].    -   b. UE location update and authorization—transactions 3[9],        3[10].    -   c. Generate enterprise identity for UE—transaction 3[11].    -   d. Register enterprise identity in SDA system (e.g., enterprise        fabric 102)—transactions 3[12]-3[15], 3[26]-3[29].    -   e. Add enterprise identity to user plane function in small cell        108—transaction 3[16], 3[18].    -   f. User plane function in small cell 108 performs IP address        allocation for UE—transaction 3[17].    -   g. MME 104 completes attach procedure 3[19], 3[20].    -   h. Signaling completed attach procedure to UE—transactions        3[19]-3[25].

With reference to FIG. 4, there is a block diagram of an example networkdevice 400 representative of switch SW1, e.g., a switch or router.Network device 400 comprises a network interface unit having a pluralityof network input/output (I/O) ports 442(1)-442(M) to send traffic to andreceive traffic from a network, and to forward traffic in the network, apacket forwarding/processing unit 443, a network processor 444 (alsoreferred to simply as “processor”), and a memory 446. The packetforwarding/processing unit 443 is, for example, one or more applicationspecific integrated circuits (ASICs) that include packet buffers, packetqueues, and other control logic for performing packet forwardingoperations. The processor 444 may include multiple processors, which maybe implemented as software or hardware processors. For example,processor 444 may include a microcontroller or microprocessor that isconfigured to perform higher level controls of network device 400. Tothis end, the memory 446 stores software instructions that, whenexecuted by the processor 444, cause the processor 444 to perform avariety of operations including operations described herein. Forexample, the memory 446 stores instructions for control logic 450 toperform operations described herein with respect to operations performedby switch SW1. Control logic 450 may also include logic components inpacket forwarding unit 443.

Memory 446 also stores data 460 used and generated by logic 450.

With reference to FIG. 5, there is a block diagram of an examplecomputer device 500 representative of MME 104. Computer device 500includes network interface unit 505 to communicate with a wired and/orwireless communication network (e.g., an enterprise network, and acellular network), and to control network devices over the network.Computer device 500 also includes a processor 554 (or multipleprocessors, which may be implemented as software or hardwareprocessors), and memory 556. Network interface unit 505 may include anEthernet card with a port (or multiple such devices) to communicate overwired Ethernet links and/or a wireless communication card with awireless transceiver to communicate over wireless links.

Memory 556 stores instructions for implementing methods describedherein. Memory 556 may include read only memory (ROM), random accessmemory (RAM), magnetic disk storage media devices, optical storage mediadevices, flash memory devices, electrical, optical, or otherphysical/tangible (non-transitory) memory storage devices. The processor554 is, for example, a microprocessor or a microcontroller that executesinstructions stored in memory. Thus, in general, the memory 556 maycomprise one or more tangible computer readable storage media (e.g., amemory device) encoded with software comprising computer executableinstructions and when the software is executed (by the processor 554) itis operable to perform the operations described herein relating to MME104.

The memory 556 may also store data 560 used and generated by logic 558.

In summary, in one aspect, a method is provided comprising: at amobility management entity (MME) configured to control an enterprisefabric: upon receiving from a mobile device via a cellular network arequest to initiate an attach procedure, acquiring from the mobiledevice a unique equipment identifier of the mobile device; generating anenterprise identity for the mobile device based on the unique equipmentidentifier, and registering the enterprise identity in the enterprisefabric; signaling to a user plane function of the cellular network thatthe mobile device has been registered in the enterprise fabric, totrigger the user plane function to acquire an Internet Protocol (IP)address for the mobile device based on the enterprise identity;receiving from the user plane function of the cellular network a messageindicating the acquired IP address; and sending to the mobile device viathe cellular network an attach accept message that includes the acquiredIP address for use by the mobile device, the attach accept messageindicating that the attach procedure is complete, and that theenterprise fabric is configured to support a communication session withthe mobile device through the cellular network.

The method may further comprise, responsive to the receiving therequest, authenticating the mobile device, and authorizing the mobiledevice to attach to the enterprise fabric.

In one form, the generating includes generating the enterprise identityas a pseudo Ethernet media access control (MAC) address; and theregistering includes registering the pseudo Ethernet MAC address in theenterprise fabric.

In one form, the unique equipment identifier of the mobile deviceincludes at least a portion of an International Mobile EquipmentIdentity number (IMEI); and the generating further includes generatingthe pseudo Ethernet MAC address based in part on the IMEI.

The generating may further include generating the pseudo Ethernet MACaddress as a combination of (i) a reserved Institute of Electrical andElectronics Engineers (IEEE) organizationally unique identifier (OUI),and (ii) a hash of the IMEI.

The registering may further include further includes registering with amap server accessible to the enterprise fabric, and wherein: the pseudoEthernet MAC address as an endpoint identifier (EID); a resource locator(RLOC) for a switch at an edge of the enterprise fabric and throughwhich a cell of the cellular network connects to the enterprise fabric;and a security group tag (SGT) associated with a security group accesscontrol list (SGACL) used to enforce enterprise fabric policy.

Each of the signaling, the receiving from the user plane function of thecellular network the message indicating the acquired IP address, and thesending to the mobile device via the cellular network the attach acceptmessage that includes the acquired IP address may be performed withoutinteracting with a serving gateway (SGW) and without interacting with apacket data network gateway (PGW) of any network.

The enterprise fabric may be implemented as Software Defined Access(SDA) including an overlay network built on an underlay network, theoverlay network including a virtual layer having a fabric control plane,a fabric data plane, and a fabric policy plane, the underlay networkincluding a physical layer having physical network devices.

In another aspect, an apparatus is provided comprising: a networkinterface to communicate with an enterprise fabric; and a processorcoupled to the network interface and configured to control theenterprise fabric, the processor further configured to: upon receivingfrom a mobile device via a cellular network a request to initiate anattach procedure, acquire from the mobile device a unique equipmentidentifier of the mobile device; generate an enterprise identity for themobile device based on the unique equipment identifier, and registeringthe enterprise identity in the enterprise fabric; signal to a user planefunction of the cellular network that the mobile device has beenregistered in the enterprise fabric, to trigger the user plane functionto acquire an Internet Protocol (IP) address for the mobile device basedon the enterprise identity; receive from the user plane function of thecellular network a message indicating the acquired IP address; and sendto the mobile device via the cellular network an attach accept messagethat includes the acquired IP address for use by the mobile device, theattach accept message indicating that the attach procedure is complete,and that the enterprise fabric is configured to support a communicationsession with the mobile device through the cellular network.

In yet another aspect, a non-transitory computer readable medium thatstores instructions is provided. The instructions, when executed by aprocessor, cause the processor to perform: upon receiving from a mobiledevice via a cellular network a request to initiate an attach procedure,acquiring from the mobile device a unique equipment identifier of themobile device; generating an enterprise identity for the mobile devicebased on the unique equipment identifier, and registering the enterpriseidentity in the enterprise fabric; signaling to a user plane function ofthe cellular network that the mobile device has been registered in theenterprise fabric, to trigger the user plane function to acquire anInternet Protocol (IP) address for the mobile device based on theenterprise identity; receiving from the user plane function of thecellular network a message indicating the acquired IP address; andsending to the mobile device via the cellular network an attach acceptmessage that includes the acquired IP address for use by the mobiledevice, the attach accept message indicating that the attach procedureis complete, and that the enterprise fabric is configured to support acommunication session with the mobile device through the cellularnetwork.

The descriptions of the various embodiments have been presented forpurposes of illustration, but are not intended to be exhaustive orlimited to the embodiments disclosed. Many modifications and variationswill be apparent to those of ordinary skill in the art without departingfrom the scope and spirit of the described embodiments. The terminologyused herein was chosen to best explain the principles of theembodiments, the practical application or technical improvement overtechnologies found in the marketplace, or to enable others of ordinaryskill in the art to understand the embodiments disclosed herein.

What is claimed is:
 1. A method comprising: at a mobility managemententity (MME) configured to control an enterprise fabric: upon receivingfrom a mobile device via a cellular network a request to initiate anattach procedure, acquiring from the mobile device a unique equipmentidentifier of the mobile device; generating an enterprise identity forthe mobile device based on the unique equipment identifier, andregistering the enterprise identity in the enterprise fabric; signalingto a user plane function of the cellular network that the mobile devicehas been registered in the enterprise fabric, to trigger the user planefunction to acquire an Internet Protocol (IP) address for the mobiledevice based on the enterprise identity; receiving from the user planefunction of the cellular network a message indicating the acquired IPaddress; and sending to the mobile device via the cellular network anattach accept message that includes the acquired IP address for use bythe mobile device, the attach accept message indicating that the attachprocedure is complete, and that the enterprise fabric is configured tosupport a communication session with the mobile device through thecellular network.
 2. The method of claim 1, further comprising,responsive to the receiving the request, authenticating the mobiledevice, and authorizing the mobile device to attach to the enterprisefabric.
 3. The method of claim 1, wherein: the generating includesgenerating the enterprise identity as a pseudo Ethernet media accesscontrol (MAC) address; and the registering includes registering thepseudo Ethernet MAC address in the enterprise fabric.
 4. The method ofclaim 3, wherein: the unique equipment identifier of the mobile deviceincludes at least a portion of an International Mobile EquipmentIdentity number (IMEI); and the generating further includes generatingthe pseudo Ethernet MAC address based in part on the IMEI.
 5. The methodof claim 4, wherein the generating further includes generating thepseudo Ethernet MAC address as a combination of (i) a reserved Instituteof Electrical and Electronics Engineers (IEEE) organizationally uniqueidentifier (OUI), and (ii) a hash of the IMEI.
 6. The method of claim 3,wherein the registering further includes registering with a map serveraccessible to the enterprise fabric, and wherein: the pseudo EthernetMAC address as an endpoint identifier (EID); a resource locator (RLOC)for a switch at an edge of the enterprise fabric and through which acell of the cellular network connects to the enterprise fabric; and asecurity group tag (SGT) associated with a security group access controllist (SGACL) used to enforce enterprise fabric policy.
 7. The method ofclaim 1, performing each of the signaling, the receiving from the userplane function of the cellular network the message indicating theacquired IP address, and the sending to the mobile device via thecellular network the attach accept message that includes the acquired IPaddress without interacting with a serving gateway (SGW) and withoutinteracting with a packet data network gateway (PGW) of any network. 8.The method of claim 1, wherein the cellular network includes a 3rdGeneration Partnership Project (3GPP) network small cell.
 9. The methodof claim 1, wherein the enterprise fabric is implemented as SoftwareDefined Access (SDA) including an overlay network built on an underlaynetwork, the overlay network including a virtual layer having a fabriccontrol plane, a fabric data plane, and a fabric policy plane, theunderlay network including a physical layer having physical networkdevices.
 10. An apparatus comprising: a network interface to communicatewith an enterprise fabric; and a processor coupled to the networkinterface and configured to control the enterprise fabric, the processorfurther configured to: upon receiving from a mobile device via acellular network a request to initiate an attach procedure, acquire fromthe mobile device a unique equipment identifier of the mobile device;generate an enterprise identity for the mobile device based on theunique equipment identifier, and registering the enterprise identity inthe enterprise fabric; signal to a user plane function of the cellularnetwork that the mobile device has been registered in the enterprisefabric, to trigger the user plane function to acquire an InternetProtocol (IP) address for the mobile device based on the enterpriseidentity; receive from the user plane function of the cellular network amessage indicating the acquired IP address; and send to the mobiledevice via the cellular network an attach accept message that includesthe acquired IP address for use by the mobile device, the attach acceptmessage indicating that the attach procedure is complete, and that theenterprise fabric is configured to support a communication session withthe mobile device through the cellular network.
 11. The apparatus ofclaim 10, wherein the apparatus if further configured to, responsive tothe receiving the request, authenticate the mobile device, and authorizethe mobile device to attach to the enterprise fabric.
 12. The apparatusof claim 10, wherein the processor is configured to: generate bygenerating the enterprise identity as a pseudo Ethernet media accesscontrol (MAC) address; and register by registering the pseudo EthernetMAC address in the enterprise fabric.
 13. The apparatus of claim 12,wherein: the unique equipment identifier of the mobile device includesat least a portion of an International Mobile Equipment Identity number(IMEI); and the processor is further configured to generate bygenerating the pseudo Ethernet MAC address based in part on the IMEI.14. The apparatus of claim 13, wherein the processor is furtherconfigured to generate by generating the pseudo Ethernet MAC address asa combination of (i) a reserved Institute of Electrical and ElectronicsEngineers (IEEE) organizationally unique identifier (OUI), and (ii) ahash of the IMEI.
 15. The apparatus of claim 12, wherein the processoris further configured to register by registering with a map serveraccessible to the enterprise fabric: the pseudo Ethernet MAC address asan endpoint identifier (EID); a resource locator (RLOC) for a switch atan edge of the enterprise fabric and through which a cell of thecellular network connects to the enterprise fabric; and a security grouptag (SGT) associated with a security group access control list (SGACL)used to enforce enterprise fabric policy.
 16. The apparatus of claim 10,wherein the processor is configured to perform each of the signal, thereceive from the user plane function of the cellular network the messageindicating the acquired IP address, and the send to the mobile devicevia the cellular network the attach accept message that includes theacquired IP address without interacting with a serving gateway (SGW)operations without interacting with a packet data network gateway (PGW)of any network.
 17. The apparatus of claim 10, wherein the cellularnetwork includes a 3^(rd) Generation Partnership Project (3GPP) networksmall cell.
 18. A non-transitory computer readable medium encoded withinstructions that, when executed by a processor of a mobility managemententity (MME) configured to control an enterprise fabric, cause theprocessor to perform: upon receiving from a mobile device via a cellularnetwork a request to initiate an attach procedure, acquiring from themobile device a unique equipment identifier of the mobile device;generating an enterprise identity for the mobile device based on theunique equipment identifier, and registering the enterprise identity inthe enterprise fabric; signaling to a user plane function of thecellular network that the mobile device has been registered in theenterprise fabric, to trigger the user plane function to acquire anInternet Protocol (IP) address for the mobile device based on theenterprise identity; receiving from the user plane function of thecellular network a message indicating the acquired IP address; andsending to the mobile device via the cellular network an attach acceptmessage that includes the acquired IP address for use by the mobiledevice, the attach accept message indicating that the attach procedureis complete, and that the enterprise fabric is configured to support acommunication session with the mobile device through the cellularnetwork.
 19. The non-transitory computer readable medium of claim 18,wherein the instructions include instructions to cause the processor toperform: generating the enterprise identity as a pseudo Ethernet mediaaccess control (MAC) address; and registering the pseudo Ethernet MACaddress in the enterprise fabric.
 20. The non-transitory computerreadable medium of claim 19, wherein: the unique equipment identifier ofthe mobile device includes at least a portion of an International MobileEquipment Identity number (IMEI); and the instructions includeinstructions to cause the processor to perform generating the pseudoEthernet MAC address based in part on the IMEI.